The functions intlen, len, and iptoa provide a very convoluted way to compute the number of decimal digits required to represent an integer. We will use this as a way to study some aspects of the gcc stack protector facility.

The following show portions of the code for intlen, compiled both with and without stack protector:

(a) Without protector

A. For both versions: What are the positions in the stack frame for buf, v, and (when present) the canary value?

B. How does the rearranged ordering of the local variables in the protected code provide greater security against a buffer overrun attack?

int len(char *s) { return strlen(s); } void iptoa (char *s, long *p) { long val *p; sprintf (s, "%ld", val); } = int intlen (long x) { long v; char buf [12]; } V = x; iptoa (buf, &v); return len (buf);